Description

aisipos

opened on Jun 3, 2025

Issue body actions

Feature or enhancement

Proposal:

Add a --cors command line option to the http.server stdlib module, which when specified will add this CORS header to all responses:

Access-Control-Allow-Origin: *

This is useful during local web development, which is a common use case for http.server. If a user is developing Javascript on one local web server, and making Javascript requests against static assets served by a separately running python -m http.server, those requests will fail due to the browser's default cross-origin request policy. With the rise in popularity of tools like pyodide and pyscript, whose implementations are subject to the same Javascript cross-origin request logic, I expect similar use cases to this to become more common. It would be useful for http.server to support an open cross-origin response header via the command line like so:

python -m http.server --cors

This allows the user to serve static assets locally that can be requested by Javascript anywhere the server is visible. The new headers are opt-in only, no default behavior is changed without the flag.

Has this already been discussed elsewhere?

I have already discussed this feature proposal on Discourse

Links to previous discussion of this feature:

I started a thread about this feature on python-ideas:
https://discuss.python.org/t/any-interest-in-adding-a-cors-option-to-python-m-http-server/92120/10

The thread has a mixed response. Some are for it, some against, and some are in favor of a more generalized approach. I discussed the feature with some developers in person at Pycon 2025, the result being that there is possibly enough interest to add this feature.

Linked PRs

• gh-135056: Add a --header CLI argument to http.server #135057
• gh-135056: Fix teardown order for Windows in test_httpservers #149320

Activity

1. aisipos

   added

   type-featureA feature request or enhancementA feature request or enhancement

   on Jun 3, 2025
2. aisipos

   added 3 commits that reference this issue on Jun 3, 2025

   pythongh-135056: Add a --cors CLI argument to http.server

   f151507

   pythongh-135056: Add a --cors CLI argument to http.server

   3f11652

   pythongh-135056: Add a --cors CLI argument to http.server

   0d02fbe
3. picnixz

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Jun 7, 2025
4. aisipos

   added 2 commits that reference this issue on Jun 20, 2025

   pythongh-135056: Simplifications and cleanups to http cors changes.

   77b5fff

   pythongh-135056: Add a --header argument to http.server cli.

   5f89c97
5. aisipos

   added 7 commits that reference this issue on Jul 10, 2025

   pythongh-135056: Remove --cors opt from http.server in favor of --header

   a3243fe

   pythongh-135056: Use response_headers only in SimpleHTTPRequestHandler

   b1026d2

   pythongh-135056: Add test for http.server cli --header argument

   6f88c13

   pythongh-135056: Support multiple headers of the same name.

   7a793f2

   pythongh-135056: Remove some commented out and unused code.

   9450b86

   pythongh-135056: Capitalize CLI acronym in the docs.

   5a30d91

   pythongh-135056: Simplify args.header processing.

   d317cc2
6. aisipos

   added a commit that references this issue on Aug 12, 2025

   pythongh-135056: Factor out a _make_server function from test function.

   5f1fb94
7. 29 remaining items
8. aisipos

   added a commit that references this issue on Oct 10, 2025

   pythongh-135056: Fix socket closing in test_extra_response_headers_arg

   79c577b
9. aisipos

   added 3 commits that reference this issue on Apr 12, 2026

   pythongh-135056: Don't let extra headers overwrite default headers

   43b0d51

   pythongh-135056: Don't let extra headers overwrite default headers

   3a4fed6

   pythongh-135056: Fix attribute access to default_response_headers

   9f0ed01
10. aisipos

    added 8 commits that reference this issue on Apr 28, 2026

    pythongh-135056: Use proper RST syntax for attribute references.

    1036a91

    pythongh-135056: Make more new args and attrs private.

    49ffc92

    pythongh-135056: Add multithreaded test for extra_response_headers

    280cea3

    pythongh-135056: Fix test_extra_response_headers_concurrent_requests

    d188977

    pythongh-135056: Don't raise exceptions in threaded tests child threads.

    9851622

    pythongh-135056: Add addCleanup calls to ensure test server thread ex…

    c40f8b1

    pythongh-135056: Refactor _default_reponse_headers usage.

    597b973

    pythongh-135056: Remove test_extra_response_headers_concurrent_requests

    347b968
11. picnixz

    added a commit that references this issue on May 3, 2026

    gh-135056: Add a `--header` CLI option to `http.server` (#135057)

    836fbda
12. picnixz

    closed this as completedon May 3, 2026
13. hugovk

    added a commit that references this issue on May 3, 2026

    gh-135056: Fix teardown order for Windows in `test_httpservers` (#149320

    0bf6e31

Issue actions